- Threat Encyclopedia
- Malware
- BKDR_REMOSH.SML
Windows 2000, Windows XP, Windows Server 2003
This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Varies
PE
No
27 May 2010
Drops files
Arrival Details
This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Other Details
This backdoor drops the following file(s)/component(s):
(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)
It does the following:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Svchost\netsvcs
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
NOTES:
This is Trend Micro's detection for malware generated by the hacking tool HKTL_REMOSH.
8.900
7.779.00
20 Jan 2011
Step 1
Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.
Step 2
Remove the malware/grayware file dropped/downloaded by BKDR_REMOSH.SML
Step 3
Scan your computer with your Trend Micro product to delete files detected as BKDR_REMOSH.SML. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.